Nigerian Gmail spam
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 22 May 2023 07:36:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1q15hE-0005Zo-Ey
for dave@doctor.nl2k.ab.ca;
Mon, 22 May 2023 07:35:32 -0600
Resent-From: The Doctor
Resent-Date: Mon, 22 May 2023 07:35:32 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yb1-f182.google.com ([209.85.219.182]:59646)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1q15cR-000ABG-Uu
for root@nk.ca;
Mon, 22 May 2023 07:30:39 -0600
Received: by mail-yb1-f182.google.com with SMTP id 3f1490d57ef6-ba81deea9c2so5278311276.2
for; Mon, 22 May 2023 06:28:37 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20221208; t=1684762111; x=1687354111;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=wHYlecEDrlbFEmnSgJ9ODi4u30t/3IwuJr8OYHwROlo=;
b=b4tL7na2pOny0YQW8MoLMHHGV4SFbwpHcIGHXNTTYXQSgVP/F+RYfFzRmWKH3sUvVQ
7EV8laVxN5SkdHUBYwX4vmGAhQnfMOhZKBe04+lMsyIjkTcyqx6GAbaxo7D2Tu5IUbyi
YIRDEZC+W1QtqSzVau+u5H99aQCyCx9/truNlM4JE2FuouPo/U7P0ktATYntrSupmZaS
D+JrJKIKVhYat50EEa17MzFlfgHLNx7BdvkfJiC4CJKT3SnyspwTbDvtcNCCBg37BEYt
Q5e0ZVuzg+RPdipCBlpk7vs8rEdqbS/g9DbNDHnj4ghUlGaw/gl/ANF6cLxDnh7SkODx
LHWQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20221208; t=1684762111; x=1687354111;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=wHYlecEDrlbFEmnSgJ9ODi4u30t/3IwuJr8OYHwROlo=;
b=efEag0rxv5ddvvkQCwkOgnIZGS8h1fAHhddzcw63H3oV0do5ym6WXEwE9PO4UPxhCD
5u7K4ANIZfXDXlUXPixweuKAle6OJOCydimETqwnirgcIHOX/wgRIQJpn8OyFrm6Vt5G
3QH1sxtsHjcB+1XGNe0uI7EwyCEui48AduJs/qoQ2xzgssI1okhWQbomT3T9SonamwgG
a7oAfDgiSQSZ9jHu0FiauMxTdXgor9ISFBluNDyIgzhoM5C/UQOk6r6h+6Yc8/y0x/q3
5F4pm1K+qDvg5OK4UqdiRVLkzOI81cuwO58VQtkqv9Oi2ZiadH/SRzqUZMGG/F6jUNBi
uszA==
X-Gm-Message-State: AC+VfDyOAClUvue8vtDsZZjoFDIR9YvxBRUkA6kFGavGq6ERf+ggYeaC
EBNZreLiIUQyPvGARuZQJO87DUrfddq0CobrJDc=
X-Google-Smtp-Source: ACHHUZ6wXEv02aXDqt8zln05nYKLn/M7iF617QoUKnqcwRisETreanpZFuMiZWyESR1B0bSQEViIlBFn+pLkp/y6xnI=
X-Received: by 2002:a25:c187:0:b0:ba7:2d19:2430 with SMTP id
r129-20020a25c187000000b00ba72d192430mr9953511ybf.28.1684762110550; Mon, 22
May 2023 06:28:30 -0700 (PDT)
MIME-Version: 1.0
Reply-To: sjc.bfs00@msn.com
From: Matt Falla
Date: Mon, 22 May 2023 21:28:08 +0800
Message-ID:
Subject: Re: Payment Ready
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000216a6705fc483f70"
Bcc: root@nk.ca
X-Spam_score: 18.5
X-Spam_score_int: 185
X-Spam_bar: ++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Beneficiary of Funds, I am wondering why you left your
funds unclaimed for this long, However,I am in the right position to process
the release of your funds within a couple of days without any d [...]
Content analysis details: (18.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.219.182 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[pc40162051(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[sjc.bfs00(at)msn.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[pc40162051(at)gmail.com]
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.219.182 listed in wl.mailspike.net]
Subject: {SPAM?} Re: Payment Ready
--000000000000216a6705fc483f70
Content-Type: text/plain; charset="UTF-8"
Dear Beneficiary of Funds,
I am wondering why you left your funds unclaimed for this long, However,I
am in the right position to process the release of your funds within a
couple of days without any delay or breach of the law. The sum of
US$4,650,000 was approved to be released to you within a couple of days.
Kindly get back to me as soon as possible with your full details for more
information. Do take note that I am contacting you in a private capacity.
Yours Faithfully ,
Mr. Matt Falla.
--000000000000216a6705fc483f70
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
--000000000000216a6705fc483f70--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 22 May 2023 07:36:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1q15hE-0005Zo-Ey
for dave@doctor.nl2k.ab.ca;
Mon, 22 May 2023 07:35:32 -0600
Resent-From: The Doctor
Resent-Date: Mon, 22 May 2023 07:35:32 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-yb1-f182.google.com ([209.85.219.182]:59646)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.95 (FreeBSD))
(envelope-from
id 1q15cR-000ABG-Uu
for root@nk.ca;
Mon, 22 May 2023 07:30:39 -0600
Received: by mail-yb1-f182.google.com with SMTP id 3f1490d57ef6-ba81deea9c2so5278311276.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20221208; t=1684762111; x=1687354111;
h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc
:subject:date:message-id:reply-to;
bh=wHYlecEDrlbFEmnSgJ9ODi4u30t/3IwuJr8OYHwROlo=;
b=b4tL7na2pOny0YQW8MoLMHHGV4SFbwpHcIGHXNTTYXQSgVP/F+RYfFzRmWKH3sUvVQ
7EV8laVxN5SkdHUBYwX4vmGAhQnfMOhZKBe04+lMsyIjkTcyqx6GAbaxo7D2Tu5IUbyi
YIRDEZC+W1QtqSzVau+u5H99aQCyCx9/truNlM4JE2FuouPo/U7P0ktATYntrSupmZaS
D+JrJKIKVhYat50EEa17MzFlfgHLNx7BdvkfJiC4CJKT3SnyspwTbDvtcNCCBg37BEYt
Q5e0ZVuzg+RPdipCBlpk7vs8rEdqbS/g9DbNDHnj4ghUlGaw/gl/ANF6cLxDnh7SkODx
LHWQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20221208; t=1684762111; x=1687354111;
h=to:subject:message-id:date:from:reply-to:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=wHYlecEDrlbFEmnSgJ9ODi4u30t/3IwuJr8OYHwROlo=;
b=efEag0rxv5ddvvkQCwkOgnIZGS8h1fAHhddzcw63H3oV0do5ym6WXEwE9PO4UPxhCD
5u7K4ANIZfXDXlUXPixweuKAle6OJOCydimETqwnirgcIHOX/wgRIQJpn8OyFrm6Vt5G
3QH1sxtsHjcB+1XGNe0uI7EwyCEui48AduJs/qoQ2xzgssI1okhWQbomT3T9SonamwgG
a7oAfDgiSQSZ9jHu0FiauMxTdXgor9ISFBluNDyIgzhoM5C/UQOk6r6h+6Yc8/y0x/q3
5F4pm1K+qDvg5OK4UqdiRVLkzOI81cuwO58VQtkqv9Oi2ZiadH/SRzqUZMGG/F6jUNBi
uszA==
X-Gm-Message-State: AC+VfDyOAClUvue8vtDsZZjoFDIR9YvxBRUkA6kFGavGq6ERf+ggYeaC
EBNZreLiIUQyPvGARuZQJO87DUrfddq0CobrJDc=
X-Google-Smtp-Source: ACHHUZ6wXEv02aXDqt8zln05nYKLn/M7iF617QoUKnqcwRisETreanpZFuMiZWyESR1B0bSQEViIlBFn+pLkp/y6xnI=
X-Received: by 2002:a25:c187:0:b0:ba7:2d19:2430 with SMTP id
r129-20020a25c187000000b00ba72d192430mr9953511ybf.28.1684762110550; Mon, 22
May 2023 06:28:30 -0700 (PDT)
MIME-Version: 1.0
Reply-To: sjc.bfs00@msn.com
From: Matt Falla
Date: Mon, 22 May 2023 21:28:08 +0800
Message-ID:
Subject: Re: Payment Ready
To: undisclosed-recipients:;
Content-Type: multipart/alternative; boundary="000000000000216a6705fc483f70"
Bcc: root@nk.ca
X-Spam_score: 18.5
X-Spam_score_int: 185
X-Spam_bar: ++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Beneficiary of Funds, I am wondering why you left your
funds unclaimed for this long, However,I am in the right position to process
the release of your funds within a couple of days without any d [...]
Content analysis details: (18.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.219.182 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[pc40162051(at)gmail.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[sjc.bfs00(at)msn.com]
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[pc40162051(at)gmail.com]
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to
1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs
3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.219.182 listed in wl.mailspike.net]
Subject: {SPAM?} Re: Payment Ready
--000000000000216a6705fc483f70
Content-Type: text/plain; charset="UTF-8"
Dear Beneficiary of Funds,
I am wondering why you left your funds unclaimed for this long, However,I
am in the right position to process the release of your funds within a
couple of days without any delay or breach of the law. The sum of
US$4,650,000 was approved to be released to you within a couple of days.
Kindly get back to me as soon as possible with your full details for more
information. Do take note that I am contacting you in a private capacity.
Yours Faithfully ,
Mr. Matt Falla.
--000000000000216a6705fc483f70
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Dear Beneficiary of Funds,
I am wondering why you left =
your funds unclaimed for this long, =C2=A0However,I am in the right positio=
n to process the release of your funds within a couple of days without any =
delay or breach of the law. The sum of US$4,650,000 was approved to be rele=
ased to you within a couple of days.
Kindly get back to me as so=
on as possible with your full details for more information. Do take note th=
at I am contacting you in a private capacity.
Yours Faithfully ,
=
Mr. Matt Falla.
I am wondering why you left =
your funds unclaimed for this long, =C2=A0However,I am in the right positio=
n to process the release of your funds within a couple of days without any =
delay or breach of the law. The sum of US$4,650,000 was approved to be rele=
ased to you within a couple of days.
Kindly get back to me as so=
on as possible with your full details for more information. Do take note th=
at I am contacting you in a private capacity.
Yours Faithfully ,
=
Mr. Matt Falla.
--000000000000216a6705fc483f70--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments